gabriellandau Goto Github PK

.github

default elastic community health files

angryorchard

A kernel exploit leveraging NtUserHardErrorControl to elevate a thread to KernelMode and achieve arbitrary kernel R/W & more.

antimalwareblight

Execute PowerShell code at the antimalware-light protection level.

backstab

A tool to kill antimalware protected processes

cispotter

Code Integrity Violation Spotter

com_inject

ctypes-windows-sdk

Ctypes port of Windows SDK (only small subset)

cve-2022-21894

baton drop (CVE-2022-21894): Secure Boot Security Feature Bypass Vulnerability

dellicious

Enabled / Disable LSA Protection via BYOVD

ecs

Elastic Common Schema

edrsandblast

edrsandblast-godfault

EDRSandblast-GodFault

extendedattributeipecac

Kernel EA Ipecac

grimreaper

A improved memory obfuscation primitive using a combination of special and 'normal' Asynchronous Procedural Calls

hooksigntool

kexecdd

Admin to Kernel code execution using the KSecDD driver

kibana

Your window into the Elastic Stack

livedump

Automatically exported from code.google.com/p/livedump

mkreglink

moneta

Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs

offensiveph

OffensivePH - use old Process Hacker driver to bypass several user-mode access controls

ppldump

Dump the memory of a PPL with a userland exploit

pplfault

pplkiller

Tool to bypass LSA Protection (aka Protected Process Light)

pplmedic

Dump the memory of any PPL with a Userland exploit chain

psutil

Cross-platform lib for process and system monitoring in Python

pytest

The pytest framework makes it easy to write small tests, yet scales to support complex functional testing

shadowstackwalk

Finding Truth in the Shadows

silhouette

Keep it secret, keep it safe

systeminformer

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals.com